Mapped to NIST 800-171 Requirement: 3.5.3 (mapped specifically to CMMC requirement IA.L2-3.5.4)
CMMC Assessment Objective: IA.L2-3.5.4
What This Control Means
This control mandates broad enforcement of MFA across both privileged and general user accounts based on the type of system access:
• Privileged Accounts: MFA is required for both local (e.g., workstation login) and remote/network access.
• Non-Privileged Accounts: MFA is required when accessing systems over a network (e.g., VPN, RDP, web portals).
This means that any remote access—and any privileged account use, local or remote—must involve at least two different types of authentication factors, such as:
• Something you know (password)
• Something you have (hardware token, app-generated code)
• Something you are (biometric)
Why It Matters
Privileged accounts represent the highest risk in a system. If compromised, they can:
• Bypass access controls
• Disable monitoring tools
• Access sensitive CUI
• Introduce malware or exfiltrate data
Meanwhile, non-privileged accounts still pose risk when used over a network—especially if credentials are stolen or phished.
MFA dramatically reduces these risks by ensuring that credential theft alone is not enough to gain access.
How to Implement It
1. Identify All Privileged Accounts
• Includes administrators, root users, domain admins, and service accounts with elevated permissions
2. Enforce MFA for Privileged Access
• Require MFA for:
◦ Remote admin sessions (e.g., RDP, SSH)
◦ Local logins to admin-level workstations and servers
◦ Remote desktop or management tools (e.g., vCenter, Azure Portal)
3. Require MFA for Non-Privileged Network Access
• Any non-admin account that connects remotely should use MFA (e.g., VPN, cloud login)
4. Use Strong MFA Methods
• App-based authenticators (TOTP)
• Hardware tokens (YubiKey, smart cards)
• Biometric readers
• Avoid SMS-based MFA where possible due to security limitations
5. Audit and Monitor Enforcement
• Review who is using MFA, where it’s enforced, and where gaps exist
• Integrate with identity and access management (IAM) platforms
Evidence the Assessor Will Look For
• MFA policy documentation for privileged and non-privileged accounts
• Screenshots of configuration settings enforcing MFA
• Logs showing MFA challenge events
• Access flow diagrams showing where MFA is applied
• Conditional Access Policy exports from identity providers
Common Gaps
• MFA is only enforced for remote admin access, not local login
• Non-privileged users connect remotely without MFA
• MFA methods are outdated or easily bypassed (e.g., SMS-only)
• MFA is enabled but not required for login
How Cuick Trac Helps
Cuick Trac supports this control by:
• Enforcing MFA across all privileged account access—local and remote
• Requiring MFA for all network access to the secure enclave, including for non-privileged users
• Integrating with major identity providers and MFA platforms
• Preventing login until multi-factor challenges are completed successfully
• Providing logs, screenshots, and configuration reports for audit readiness
Cuick Trac ensures consistent MFA enforcement across users, systems, and access types.
Final CTA
MFA isn’t just for remote access anymore. It’s for every account that matters.
Schedule a Cuick Trac demo and lock down both privileged and remote user access with smart, enforced MFA.